Junglewise Threat Intelligence

CVE-2024-26960: Linux Kernel race condition in free_swap_and_cache

CVE-2024-26960 · Severity: medium · CVSS 5.5 · Published 2024-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's memory management system could allow a local user to cause a system crash. The issue stems from a race condition when the system is disabling swap space while simultaneously freeing memory. While primarily a theoretical risk, if triggered, it could lead to a denial-of-service by causing the operating system to access memory that has already been released.

Technical details

A race condition exists between free_swap_and_cache() and swapoff() in the Linux kernel's memory management (mm) subsystem. Specifically, swapoff() could teardown a swap_info_struct while free_swap_and_cache() is still executing in another thread, leading to a use-after-free scenario where swap_page_trans_huge_swapped() accesses freed memory in the swap_map. The vulnerability is rooted in improper synchronization; it is resolved by implementing get_swap_device() and put_swap_device() calls to properly stall swapoff() until the swap entry reference is released. The fix also includes an explicit check in free_swap_and_cache() to ensure the swap entry remains valid.

Affected products

  • Linux Linux Kernel 4.11 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-03-06: patched: Initial patch proposed by Ryan Roberts
  • 2024-05-01: advisory: CVE-2024-26960 published

References

Related threats